Clarify SSO credential authorization as GitHub Enterprise Cloud–only in credential types reference by Copilot · Pull Request #43860 · github/docs

Copilot · 2026-04-17T14:17:08Z

The SSO authorization section in github-credential-types.md was rendered for all versions, which made GHES readers see guidance for UI/API options they do not have. This update tightens scope language so SSO credential authorization behavior is explicitly GHEC-only and explicitly excluded for GHES.

Scope corrections in SSO authorization content
- Updated the ## SSO authorization intro to start with GHEC context and explicitly state non-applicability to GHES.
- Updated the SSO footnote ([^1]) to scope automatic app authorization behavior to GHEC.
Scope corrections where SSO behavior is referenced outside the section
- Updated SSO-related bullets in OAuth app and GitHub App user token revocation sections to begin with GHEC context and state GHES exclusion.
- Updated revocation guidance under ### Revoking SSO authorization so REST/UI/bulk statements are explicitly GHEC-scoped.
No version-conditional rendering changes
- Applied prose-only clarification (no {% ifversion %} changes), preserving article structure and availability across versions.

On {% data variables.product.prodname_ghe_cloud %}, when single sign-on (SSO) ...
... SSO credential authorization does not apply to {% data variables.product.prodname_ghe_server %}.

Original prompt

The SSO authorization section in content/organizations/managing-programmatic-access-to-your-organization/github-credential-types.md currently renders for all versions (including GitHub Enterprise Server), but actually only applies to GitHub Enterprise Cloud. To address this:

Edit the relevant section(s) so it's clear SSO credential authorization features only apply to GitHub Enterprise Cloud.

For affected paragraphs/steps, begin with wording such as "On GitHub Enterprise Cloud".

Explicitly state that SSO credential authorization does not apply to GitHub Enterprise Server anywhere this context is needed.

Do NOT add {% ifversion %} tags—use only prose.

Ensure the scope is clear anywhere SSO authorization behavior is described or referenced.

Reference Slack thread discussion: Customers are confused because docs show SSO authorization guidance in GHES versions where those options are not present, and GHEC-specific links are hardcoded/unhelpful for GHES readers.

Do not change unrelated content. Only clarify the scope as described above.

This pull request was created from Copilot chat.

Agent-Logs-Url: https://github.com/github/docs/sessions/80fc9a39-8af0-4f3e-8684-bf106bf329c4 Co-authored-by: myarb <11952755+myarb@users.noreply.github.com>

github-actions · 2026-04-17T14:57:10Z

How to review these changes 👓

Thank you for your contribution. To review these changes, choose one of the following options:

A Hubber will need to deploy your changes internally to review.

Table of review links

Note: Please update the URL for your staging server or codespace.

The table shows the files in the content directory that were changed in this pull request. This helps you review your changes on a staging server. Changes to the data directory are not included in this table.

Source	Review	Production	What Changed
`organizations/managing-programmatic-access-to-your-organization/github-credential-types.md`	fpt ghec ghes@ 3.20 3.19 3.18 3.17 3.16 3.15 3.14	fpt ghec ghes@ 3.20 3.19 3.18 3.17 3.16 3.15 3.14

Key: fpt: Free, Pro, Team; ghec: GitHub Enterprise Cloud; ghes: GitHub Enterprise Server

🤖 This comment is automatically generated.

jc-clark

LGTM from a docs perspective. @wilsonwong1990, this is the PR Copilot opened from the Slack thread. What do you think of these changes?

Copilot

Pull request overview

This PR clarifies that SSO credential authorization behavior described in the credential types reference applies to {% data variables.product.prodname_ghe_cloud %} only, so readers on {% data variables.product.prodname_ghe_server %} don’t interpret cloud-only UI/API options as available on server.

Changes:

Updated SSO authorization section intro and footnote to explicitly scope behavior to {% data variables.product.prodname_ghe_cloud %} and exclude {% data variables.product.prodname_ghe_server %}.
Updated SSO-related revocation bullets (OAuth app tokens, GitHub App user access tokens) to add explicit {% data variables.product.prodname_ghe_cloud %}-only context.
Updated “Revoking SSO authorization” guidance to clearly scope UI/REST/bulk actions to {% data variables.product.prodname_ghe_cloud %}.

Show a summary per file

File	Description
content/organizations/managing-programmatic-access-to-your-organization/github-credential-types.md	Adds explicit cloud-only scoping for SSO credential authorization/revocation guidance throughout the reference.

Copilot's findings

Files reviewed: 1/1 changed files
Comments generated: 2

Copilot · 2026-04-17T16:30:07Z

 | `GITHUB_TOKEN` ({% data variables.product.prodname_actions %}) | {% octicon "x" aria-label="No" %} (repository-scoped) | Not applicable |

-[^1]: SSO authorization is granted automatically when the user authorizes the app during an active SAML or OIDC session. These authorizations are not visible to users or admins in the {% data variables.product.github %} UI, and are not returned by the [List SAML SSO authorizations for an organization](/rest/orgs/orgs#list-saml-sso-authorizations-for-an-organization) REST API endpoint.
+[^1]: On {% data variables.product.prodname_ghe_cloud %}, SSO authorization is granted automatically when the user authorizes the app during an active SAML or OIDC session. These authorizations are not visible to users or admins in the {% data variables.product.github %} UI, and are not returned by the [List SAML SSO authorizations for an organization](/rest/orgs/orgs#list-saml-sso-authorizations-for-an-organization) REST API endpoint.


Link text to another docs page should use AUTOTITLE rather than hardcoding the page title. Consider changing this REST docs link to the AUTOTITLE format so it stays accurate if the endpoint heading changes.

Suggested change

[^1]: On {% data variables.product.prodname_ghe_cloud %}, SSO authorization is granted automatically when the user authorizes the app during an active SAML or OIDC session. These authorizations are not visible to users or admins in the {% data variables.product.github %} UI, and are not returned by the [List SAML SSO authorizations for an organization](/rest/orgs/orgs#list-saml-sso-authorizations-for-an-organization) REST API endpoint.

[^1]: On {% data variables.product.prodname_ghe_cloud %}, SSO authorization is granted automatically when the user authorizes the app during an active SAML or OIDC session. These authorizations are not visible to users or admins in the {% data variables.product.github %} UI, and are not returned by the [AUTOTITLE](/rest/orgs/orgs#list-saml-sso-authorizations-for-an-organization) REST API endpoint.

Copilot · 2026-04-17T16:30:07Z

 * **Enterprise owners** can manage SSO authorizations for enterprises with enterprise-level SSO (including {% data variables.product.prodname_emus %}) via the {% data variables.product.github %} UI. See [AUTOTITLE](/enterprise-cloud@latest/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/viewing-and-managing-a-users-saml-access-to-your-enterprise#viewing-and-revoking-authorized-credentials).

-You can also manage SSO authorizations via the REST API. See [AUTOTITLE](/rest/orgs/orgs?apiVersion=2022-11-28#list-saml-sso-authorizations-for-an-organization).
+On {% data variables.product.prodname_ghe_cloud %}, you can also manage SSO authorizations via the REST API. See [AUTOTITLE](/rest/orgs/orgs?apiVersion=2022-11-28#list-saml-sso-authorizations-for-an-organization).


This REST link includes an apiVersion query parameter, which the docs style guide advises avoiding unless you’re intentionally pinning to a specific calendar version. Also, this endpoint is already linked in footnote [^1], so this is a repeated link within the article—consider removing one of the links (or rewording this sentence to refer back to the earlier link) to align with the “don’t repeat the same link” guidance.

Suggested change

On {% data variables.product.prodname_ghe_cloud %}, you can also manage SSO authorizations via the REST API. See [AUTOTITLE](/rest/orgs/orgs?apiVersion=2022-11-28#list-saml-sso-authorizations-for-an-organization).

On {% data variables.product.prodname_ghe_cloud %}, you can also manage SSO authorizations via the REST API.

Initial plan

71201ac

Copilot AI assigned Copilot and myarb Apr 17, 2026

Copilot started work on behalf of myarb April 17, 2026 14:17 View session

Clarify SSO authorization scope as GHEC-only in credential reference

69f1fa4

Agent-Logs-Url: https://github.com/github/docs/sessions/80fc9a39-8af0-4f3e-8684-bf106bf329c4 Co-authored-by: myarb <11952755+myarb@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Clarify SSO authorization features for GitHub Enterprise Cloud~~ Clarify SSO credential authorization as GitHub Enterprise Cloud–only in credential types reference Apr 17, 2026

Copilot AI requested a review from myarb April 17, 2026 14:27

Copilot stopped work on behalf of myarb due to an error April 17, 2026 14:27
The "Index fixtures into the local Elasticsearch" custom setup step from your .github/workflows/copilot-setup-steps.yml file failed.

Merge branch 'main' into copilot/update-sso-authorization-for-ec

b1cbadd

jc-clark requested a review from wilsonwong1990 April 17, 2026 16:26

jc-clark approved these changes Apr 17, 2026

View reviewed changes

jc-clark marked this pull request as ready for review April 17, 2026 16:27

Copilot AI review requested due to automatic review settings April 17, 2026 16:27

Copilot started reviewing on behalf of jc-clark April 17, 2026 16:28 View session

Copilot AI reviewed Apr 17, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Clarify SSO credential authorization as GitHub Enterprise Cloud–only in credential types reference#43860

Clarify SSO credential authorization as GitHub Enterprise Cloud–only in credential types reference#43860
Copilot wants to merge 3 commits intomainfrom
copilot/update-sso-authorization-for-ec

Copilot AI commented Apr 17, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Apr 17, 2026

Uh oh!

jc-clark left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 17, 2026

Uh oh!

Copilot AI Apr 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

	On {% data variables.product.prodname_ghe_cloud %}, you can also manage SSO authorizations via the REST API. See [AUTOTITLE](/rest/orgs/orgs?apiVersion=2022-11-28#list-saml-sso-authorizations-for-an-organization).
	On {% data variables.product.prodname_ghe_cloud %}, you can also manage SSO authorizations via the REST API.

Conversation

Copilot AI commented Apr 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Apr 17, 2026

How to review these changes 👓

Uh oh!

jc-clark left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Copilot AI Apr 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 17, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Apr 17, 2026 •

edited

Loading